WordPress Vulnerabilities: How to Check if Your Plugins Are at Risk

Most hacked WordPress sites were not hacked through WordPress itself. They were hacked through a plugin. According to Patchstack's State of WordPress Security in 2026 report, 91% of new WordPress vulnerabilities found in 2025 were in plugins and 9% in themes, and the number of highly exploitable vulnerabilities more than doubled in a year. Wordfence's weekly reports regularly list hundreds of new vulnerabilities across hundreds of plugins in a single week.

The good news: a vulnerability is usually fixed by an update that already exists. This guide shows how to check whether your plugins and themes are at risk, what the risk levels mean, and a routine that keeps you ahead of the next one.

What a WordPress vulnerability actually is#

A vulnerability is a flaw in code that lets someone do something they should not: read data, change content, run their own code, or log in as an admin. In WordPress, the common types are:

• Cross-site scripting (XSS). An attacker gets their own JavaScript to run in a visitor's or admin's browser. It is the most common type reported.
• Broken access control. A feature meant for admins can be used by a logged-out visitor or a low-level user.
• SQL injection. An attacker can read or change your database.
• Arbitrary file upload. An attacker can upload a file, often a PHP backdoor, and take over the site.
• Privilege escalation. A subscriber-level user can make themselves an administrator.

Not every vulnerability is equally dangerous. A flaw that needs an admin login to exploit is far less urgent than one any visitor can trigger.

How to check if your plugins have known vulnerabilities#

1. Start with what is installed#

Go to Plugins > Installed Plugins and Appearance > Themes. Note every plugin and theme, active or not. Inactive plugins can still be exploited if their files are on the server, so delete anything you do not use.

2. Check each one against a vulnerability database#

Free public databases list known vulnerabilities by plugin and version:

• WPScan (wpscan.com), run by Automattic.
• Patchstack Database (patchstack.com/database).
• Wordfence Intelligence (wordfence.com/threat-intel).

Search for the plugin name and compare the affected versions with yours. If your version is in the affected range, look for the fixed version.

3. Or let a plugin do it for you#

Checking by hand does not scale past a few plugins. Security plugins such as Wordfence, Patchstack and Solid Security check your installed versions against their databases and warn you in wp-admin. The free MyKavo WordPress plugin also shows how many installed plugins have a known vulnerability on every plan, and on paid plans which plugin, what the issue is and the version that fixes it.

4. Check the plugin is still maintained#

A plugin that has not been updated in two years, or was closed on WordPress.org, will not get a fix when the next issue is found. On its WordPress.org page, look at "Last updated" and whether a notice says it was closed. Replace abandoned plugins with maintained alternatives.

How to read the severity#

Most databases score vulnerabilities with CVSS, from 0 to 10:

Also check two things the score does not tell you: whether the flaw needs a login (unauthenticated is worse), and whether it is being exploited in the wild. A medium issue under active attack is more urgent than a high one nobody is using.

What to do when a plugin you use is vulnerable#

1. Update to the fixed version. This solves most cases. Take a backup first; see our WordPress backup guide.
2. No fix yet? Deactivate and delete the plugin until one is released, or replace it. If you cannot remove it, a web application firewall with virtual patching (Patchstack, Wordfence premium, Cloudflare WAF rules) can block the known attack.
3. Check you were not already hit. Look for admin users you do not recognise, new files in wp-content/uploads ending in .php, and changes to your pages. If you find signs, follow our guide to a hacked WordPress site.
4. Test after updating. Security updates are still updates and can break things. Check your key pages, forms and checkout. Our guide on how to safely update WordPress plugins covers a quick routine.

A routine that keeps you ahead#

• Update weekly, and security releases as soon as they are out.
• Turn on automatic updates for well-maintained plugins, with monitoring that checks your pages afterwards. Our guide to WordPress automatic updates explains how to choose.
• Remove what you do not use, including old themes. Keep one default theme as a fallback.
• Use strong passwords and two-factor login for every administrator, and as few administrators as possible.
• Keep PHP and WordPress core current. WordPress 7.1.4 is the current release, with WordPress 7.2 planned for December 8, 2026.
• Run WordPress Site Health monthly; it flags outdated PHP and other risks.
• Keep backups off-site, so a worst case is an inconvenience, not a disaster.

Catch the update, and the attack, as it happens#

Fixing vulnerabilities means updating often, and updating often means more chances for something to break. The free MyKavo WordPress plugin is built for both sides of that:

• Known security issues. Every plan sees how many installed plugins have a known vulnerability. Paid plans, from Starter, see which plugin, the issue and the fixed version; Pro and Agency can update vulnerable plugins automatically as soon as the fix is out.
• Silent-disaster alerts (free). A new administrator appearing, the admin email changing, the site address changing or search engines being discouraged: a red notice on every wp-admin screen, and an instant email or Slack alert on paid plans. These are classic signs of a break-in.
• Every update recorded and checked. On paid plans, MyKavo checks your key pages right after each update and names the update behind any change.
• Snapshots and "Did it crash?" (free). A copy of each plugin is saved right before it updates, and the site checks itself for errors about ten seconds after, so a bad security update can be rolled back in one click.

Summary#

Most WordPress vulnerabilities are in plugins, and most are fixed by an update that already exists. List what you have installed, check it against WPScan, Patchstack or Wordfence, or let a plugin do it for you, and update critical and high issues right away. Remove abandoned and unused plugins, protect admin accounts, keep backups, and watch for the signs of a break-in so you can act within minutes, not weeks.